Logstash Grok - Extract field if field exists & deleting character

[gringorion (Edouard)]

Hello Guys,

My case is simple, but can't find the perfect response.

I need to extract the field: user@domain into 2 fields.
This step is OK:
%{WORD:user}%{NOTSPACE:domain}?
gives:

{
  "user": "user",
  "domain": "@domain"
}

This domain field is not present all the time, so I may have only user, this is why I have the ? character:

so the field: user
gives

{
  "user": "user"
}

with the same Grok Pattern

What I don't succeed to do, is to delete the @ in domain field when this field is found, using the same pattern in both cases.

Do you have any idea ?

Many thanks

[Badger]

You could try

%{WORD:user}@?%{NOTSPACE:domain}?

[gringorion (Edouard)]

I knew it was a great idea to post here.
Badger, I think I owe you a beer!

thanks a lot !